On 4/14/26 17:49, Tvrtko Ursulin wrote:
> Trace_dma_fence_signaled, trace_dma_fence_wait_end and
> trace_dma_fence_destroy can all currently dereference a null fence->ops
> pointer after it has been reset on fence signalling.
>
> Lets use the safe string getters for most tracepoints to avoid this class
> of a problem, while for the signal tracepoint we move it to before ops are
> cleared to avoid losing the driver and timeline name information. Apart
> from moving it we also need to add a new tracepoint class to bypass the
> safe name getters since the signaled bit is already set.
>
> For dma_fence_init we also need to use the new tracepoint class since the
> rcu read lock is not held there, and we can do the same for the enable
> signaling since there we are certain the fence cannot be signaled while
> we are holding the lock and have even validated the fence->ops.
>
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com>
> Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3")
> Cc: Christian König <christian.koenig(a)amd.com>
> Cc: Philipp Stanner <phasta(a)kernel.org>
> Cc: Boris Brezillon <boris.brezillon(a)collabora.com>
> Cc: linux-media(a)vger.kernel.org
> Cc: linaro-mm-sig(a)lists.linaro.org
> ---
> drivers/dma-buf/dma-fence.c | 3 ++-
> include/trace/events/dma_fence.h | 33 ++++++++++++++++++++++++++++----
> 2 files changed, 31 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
> index a2aa82f4eedd..b3bfa6943a8e 100644
> --- a/drivers/dma-buf/dma-fence.c
> +++ b/drivers/dma-buf/dma-fence.c
> @@ -363,6 +363,8 @@ void dma_fence_signal_timestamp_locked(struct dma_fence *fence,
> &fence->flags)))
> return;
>
> + trace_dma_fence_signaled(fence);
> +
> /*
> * When neither a release nor a wait operation is specified set the ops
> * pointer to NULL to allow the fence structure to become independent
> @@ -377,7 +379,6 @@ void dma_fence_signal_timestamp_locked(struct dma_fence *fence,
>
> fence->timestamp = timestamp;
> set_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags);
> - trace_dma_fence_signaled(fence);
I think this part here should be a separate patch.
>
> list_for_each_entry_safe(cur, tmp, &cb_list, node) {
> INIT_LIST_HEAD(&cur->node);
> diff --git a/include/trace/events/dma_fence.h b/include/trace/events/dma_fence.h
> index 3abba45c0601..9e0cb9ce2388 100644
> --- a/include/trace/events/dma_fence.h
> +++ b/include/trace/events/dma_fence.h
> @@ -9,12 +9,37 @@
>
> struct dma_fence;
>
> +DECLARE_EVENT_CLASS(dma_fence,
> +
> + TP_PROTO(struct dma_fence *fence),
> +
> + TP_ARGS(fence),
> +
> + TP_STRUCT__entry(
> + __string(driver, dma_fence_driver_name(fence))
> + __string(timeline, dma_fence_timeline_name(fence))
> + __field(unsigned int, context)
> + __field(unsigned int, seqno)
> + ),
> +
> + TP_fast_assign(
> + __assign_str(driver);
> + __assign_str(timeline);
> + __entry->context = fence->context;
> + __entry->seqno = fence->seqno;
> + ),
> +
> + TP_printk("driver=%s timeline=%s context=%u seqno=%u",
> + __get_str(driver), __get_str(timeline), __entry->context,
> + __entry->seqno)
> +);
> +
Mhm, I'm strongly in favor to just use this approach for all trace points.
The minimal extra overhead shouldn't really matter at all.
Regards,
Christian.
> /*
> * Safe only for call sites which are guaranteed to not race with fence
> * signaling,holding the fence->lock and having checked for not signaled, or the
> * signaling path itself.
> */
> -DECLARE_EVENT_CLASS(dma_fence,
> +DECLARE_EVENT_CLASS(dma_fence_ops,
>
> TP_PROTO(struct dma_fence *fence),
>
> @@ -46,7 +71,7 @@ DEFINE_EVENT(dma_fence, dma_fence_emit,
> TP_ARGS(fence)
> );
>
> -DEFINE_EVENT(dma_fence, dma_fence_init,
> +DEFINE_EVENT(dma_fence_ops, dma_fence_init,
>
> TP_PROTO(struct dma_fence *fence),
>
> @@ -60,14 +85,14 @@ DEFINE_EVENT(dma_fence, dma_fence_destroy,
> TP_ARGS(fence)
> );
>
> -DEFINE_EVENT(dma_fence, dma_fence_enable_signal,
> +DEFINE_EVENT(dma_fence_ops, dma_fence_enable_signal,
>
> TP_PROTO(struct dma_fence *fence),
>
> TP_ARGS(fence)
> );
>
> -DEFINE_EVENT(dma_fence, dma_fence_signaled,
> +DEFINE_EVENT(dma_fence_ops, dma_fence_signaled,
>
> TP_PROTO(struct dma_fence *fence),
>
On 4/14/26 12:55, popov.nkv(a)gmail.com wrote:
> From: Vladimir Popov <popov.nkv(a)gmail.com>
>
> If vmw_execbuf_fence_commands() call fails in
> vmw_kms_helper_validation_finish(), it sets *p_fence = NULL. If
> ctx->bo_list is not empty, the caller, vmw_kms_helper_validation_finish(),
> passes the fence through a chain of functions to dma_fence_is_array(),
> which causes a NULL pointer dereference in dma_fence_is_array():
>
> vmw_kms_helper_validation_finish() // pass NULL fence
> vmw_validation_done()
> vmw_validation_bo_fence()
> ttm_eu_fence_buffer_objects() // pass NULL fence
> dma_resv_add_fence()
> dma_fence_is_container()
> dma_fence_is_array() // NULL deref
Well good catch, but that is clearly not the right fix.
I'm not an expert for the vmwgfx code but in case of an error vmw_validation_revert() should be called an not vmw_kms_helper_validation_finish().
Regards,
Christian.
>
> Fix this by adding a NULL check in vmw_validation_bo_fence(): if the fence
> is NULL, fall back to ttm_eu_backoff_reservation()to safely release
> the buffer object reservations without attempting to add a NULL fence to
> dma_resv. This is safe because when fence is NULL, vmw_fallback_wait()
> has already been called inside vmw_execbuf_fence_commands() to synchronize
> the GPU.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Fixes: 038ecc503236 ("drm/vmwgfx: Add a validation module v2")
> Cc: stable(a)vger.kernel.org
> Signed-off-by: Vladimir Popov <popov.nkv(a)gmail.com>
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_validation.h | 13 ++++++++++---
> 1 file changed, 10 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
> index 353d837907d8..fc04555ca505 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_validation.h
> @@ -127,16 +127,23 @@ vmw_validation_bo_reserve(struct vmw_validation_context *ctx,
> * vmw_validation_bo_fence - Unreserve and fence buffer objects registered
> * with a validation context
> * @ctx: The validation context
> + * @fence: Fence with which to fence all buffer objects taking part in the
> + * command submission.
> *
> * This function unreserves the buffer objects previously reserved using
> - * vmw_validation_bo_reserve, and fences them with a fence object.
> + * vmw_validation_bo_reserve, and fences them with a fence object if the
> + * given fence object is not NULL.
> */
> static inline void
> vmw_validation_bo_fence(struct vmw_validation_context *ctx,
> struct vmw_fence_obj *fence)
> {
> - ttm_eu_fence_buffer_objects(&ctx->ticket, &ctx->bo_list,
> - (void *) fence);
> + /* fence is able to be NULL if vmw_execbuf_fence_commands() fails */
> + if (fence)
> + ttm_eu_fence_buffer_objects(&ctx->ticket, &ctx->bo_list,
> + (void *)fence);
> + else
> + ttm_eu_backoff_reservation(&ctx->ticket, &ctx->bo_list);
> }
>
> /**
> --
> 2.43.0
>
Ghost mystery recovery Hacker in 2026, was Verified as The Best Cryptocurrency Recovery
ghost mystery recovery Hacker, established in 2026, is a trusted leader in cryptocurrency recovery. Known for its professionalism, ghost helps clients recover lost or stolen funds from scams, hacks, and unauthorized transactions. With advanced tools and a dedicated team, they offer tailored solutions for ghost recovery across blockchains. Customers value ghost for its transparency, fast response, and confidential service. Its success rate and commitment make it a top choice for crypto investors.
Email address: support@ ghostmysteryrecovery. c om
WhatsApp on (+44) 7480 061765
Website; ghostmysteryrecovery. c om
In the world of crypto, speed and security aren’t just conveniences—they’re essentials. That’s exactly what Flash USDT delivers. Designed for traders, businesses, and anyone who values instant and reliable transfers, Flash USDT is a powerful software tailored for peer-to-peer USDT (Tether) transactions that are fast, low-cost, and seamless.
Official Website: https://globalflashhubs.com/
Whether you're managing a P2P exchange or simply need a trusted tool for transferring digital assets, Flash BTC and USDT offer the performance and security you expect, integrated smoothly into your workflow.
What’s New with Flash Coin and Generator Software?
Enhanced support for trading P2P across BTC and USDT TRC20 networks, catering to betting, gaming, and forex platforms.
New installation guides for Windows and mobile devices, making setup easier than ever.
Expanded blockch@in compatibility, allowing you to flash coins directly to Bin@nce, Trust Wallet, and more with confidence.
Flash BTC and USDT TRC20 transfers last up to 90 days, ensuring flexibility
Why Choose Flash Coin?
It’s more than just software—it’s a commitment to trust and efficiency. With Flash Coin, you gain access to one of the most reliable services online for crypto transactions, designed to keep your exchanges swift and secure across multiple platforms.
Ready to experience the difference? Shop now and see why traders and businesses worldwide rely on Flash Coin for their digital asset needs.
Get Started Today
Learn how to install and operate Flash Generator software with easy-to-follow instructions for your device. Whether on desktop or mobile, integrating this tool into your daily routine has never been simpler.
Have questions or need support? Reach out directly through our official channels:
Official Website: https://globalflashhubs.com/
WhatsApp: https://wa.link/8q02qv
Telegram: https://t.me/billier5
Explore more about our products and how Flash USDT can transform your crypto experience:
By combining cross-chain tracing, rapid response, and data-driven investigation, Cipher Rescue Chain stands as the global benchmark for crypto recovery. Every traced transaction, every reconstructed path, and every recovered asset reinforces the same conclusion: with the right forensic expertise, recovery is not only possible—it is highly achievable.
On 4/9/26 14:38, Andi Shyti wrote:
> Hi Christian,
>
>> @@ -845,9 +845,8 @@ void dma_buf_put(struct dma_buf *dmabuf)
>> if (WARN_ON(!dmabuf || !dmabuf->file))
>> return;
>>
>> - fput(dmabuf->file);
>> -
>> DMA_BUF_TRACE(trace_dma_buf_put, dmabuf);
>> + fput(dmabuf->file);
>
> funny, I just found out I sent the exact same patch, just few
> minutes later :-) [*]
I liked your patch better since it has more accurate tags.
Just reviewed and pushed that one to drm-misc-fixes, should land upstream by the end of the week.
Regards,
Christian.
>
> Andi
>
>> }
>
> [*] https://lore.kernel.org/all/20260408123916.2604101-2-andi.shyti@kernel.org/
Hi Philipp,
On 4/13/26 03:47, Philipp Stanner wrote:
> On Sat, 2026-04-11 at 15:47 -0300, MaÃra Canal wrote:
>> The kerneldoc comment on dma_fence_init() and dma_fence_init64() describe
>> the legacy reason to pass an external lock as a need to prevent multiple
>> fences "from signaling out of order". However, this wording is a bit
>> misleading: a shared spinlock does not (and cannot) prevent the signaler
>> from signaling out of order. Signaling order is the driver's responsibility
>> regardless of whether the lock is shared or per-fence.
>>
>> What a shared lock actually provides is serialization of signaling and
>> observation across fences in a given context, so that observers never
>> see a later fence signaled while an earlier one is not.
>>
>> Reword both comments to describe this more accurately.
>>
>> Signed-off-by: MaÃra Canal <mcanal(a)igalia.com>
>> ---
>>
>> Hi,
>>
>> While reading the documentation, I found this particular paragraph quite
>> hard to understand. As I understand it, locks don't enforce order, only
>> serialization, but the paragraph seems to communicate the other way around.
>
> Yes, 100%.
> That's one of the reasons why Christian recently moved to using inline-
> locks.
>
>
>
>> Due to that, I had the impression that the current wording can be
>> misleading for driver developers.
>>
>> I'm proposing a new wording to better describe the use case of the
>> external lock based on my understanding, but it would be great to hear
>> the feedback and suggestions from more experienced developers who might
>> have more insight about these legacy use cases.
>>
>> Best regards,
>> - MaÃra
>>
>> Â drivers/dma-buf/dma-fence.c | 12 ++++++++----
>> Â 1 file changed, 8 insertions(+), 4 deletions(-)
>>
>> diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
>> index 1826ba73094c..bdc29d1c1b5c 100644
>> --- a/drivers/dma-buf/dma-fence.c
>> +++ b/drivers/dma-buf/dma-fence.c
>> @@ -1102,8 +1102,10 @@ __dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
>> Â * to check which fence is later by simply using dma_fence_later().
>> Â *
>> Â * It is strongly discouraged to provide an external lock because this couples
>> - * lock and fence life time. This is only allowed for legacy use cases when
>> - * multiple fences need to be prevented from signaling out of order.
>> + * lock and fence lifetime. This is only allowed for legacy use cases that need
>> + * a shared lock to serialize signaling and observation of fences within a
>> + * context, so that observers never see a later fence signaled while an earlier
>> + * one isn't.
>
> I would probably delete the explanation altogether and just state
> "allowed for legacy reasons". The legacy people know why it's allowed,
> and new users don't need to care. Same below of course.
Actually, I ended up in this part of the documentation as I'm thinking
about dropping the external lock in v3d driver. I was reading the docs
exactly to know if v3d is a legacy use case (spoiler: it isn't) and I
got confused by the current wording. So, I think there is value in
documenting the legacy use cases for the external lock.
Maybe, instead of "strongly discouraged", we could add a disclaimer
like: "New drivers MUST NOT use an external lock because...". What do
you think?
Best regards,
- MaÃra
>
>
> Thx
> P.
>
>> Â */
>> Â void
>> Â dma_fence_init(struct dma_fence *fence, const struct dma_fence_ops *ops,
>> @@ -1129,8 +1131,10 @@ EXPORT_SYMBOL(dma_fence_init);
>> Â * to check which fence is later by simply using dma_fence_later().
>> Â *
>> Â * It is strongly discouraged to provide an external lock because this couples
>> - * lock and fence life time. This is only allowed for legacy use cases when
>> - * multiple fences need to be prevented from signaling out of order.
>> + * lock and fence lifetime. This is only allowed for legacy use cases that need
>> + * a shared lock to serialize signaling and observation of fences within a
>> + * context, so that observers never see a later fence signaled while an earlier
>> + * one isn't.
>> Â */
>> Â void
>> Â dma_fence_init64(struct dma_fence *fence, const struct dma_fence_ops *ops,
>
On 4/13/26 12:05, Tvrtko Ursulin wrote:
> Trace_dma_fence_signaled, trace_dma_fence_wait_end and
> trace_dma_fence_destroy can all dereference a null fence->ops pointer
> after it has been reset on fence signalling.
>
> Lets use the safe string getters for most tracepoints to a void this.
>
> But for the signalling tracepoint, we move it to before the fence->ops
> is reset and special case its definition in order to avoid losing the
> driver and timeline information.
>
> Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com>
> Fixes: 541c8f2468b9 ("dma-buf: detach fence ops on signal v3")
> Cc: Christian König <christian.koenig(a)amd.com>
> Cc: Philipp Stanner <phasta(a)kernel.org>
> Cc: Boris Brezillon <boris.brezillon(a)collabora.com>
> Cc: linux-media(a)vger.kernel.org
> Cc: linaro-mm-sig(a)lists.linaro.org
> ---
> drivers/dma-buf/dma-fence.c | 3 ++-
> include/trace/events/dma_fence.h | 29 +++++++++++++++++++++++++++--
> 2 files changed, 29 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/dma-buf/dma-fence.c b/drivers/dma-buf/dma-fence.c
> index a2aa82f4eedd..b3bfa6943a8e 100644
> --- a/drivers/dma-buf/dma-fence.c
> +++ b/drivers/dma-buf/dma-fence.c
> @@ -363,6 +363,8 @@ void dma_fence_signal_timestamp_locked(struct dma_fence *fence,
> &fence->flags)))
> return;
>
> + trace_dma_fence_signaled(fence);
> +
> /*
> * When neither a release nor a wait operation is specified set the ops
> * pointer to NULL to allow the fence structure to become independent
> @@ -377,7 +379,6 @@ void dma_fence_signal_timestamp_locked(struct dma_fence *fence,
>
> fence->timestamp = timestamp;
> set_bit(DMA_FENCE_FLAG_TIMESTAMP_BIT, &fence->flags);
> - trace_dma_fence_signaled(fence);
>
> list_for_each_entry_safe(cur, tmp, &cb_list, node) {
> INIT_LIST_HEAD(&cur->node);
> diff --git a/include/trace/events/dma_fence.h b/include/trace/events/dma_fence.h
> index 3abba45c0601..220bf71446e8 100644
> --- a/include/trace/events/dma_fence.h
> +++ b/include/trace/events/dma_fence.h
> @@ -9,12 +9,37 @@
>
> struct dma_fence;
>
> +DECLARE_EVENT_CLASS(dma_fence,
> +
> + TP_PROTO(struct dma_fence *fence),
> +
> + TP_ARGS(fence),
> +
> + TP_STRUCT__entry(
> + __string(driver, dma_fence_driver_name(fence))
> + __string(timeline, dma_fence_timeline_name(fence))
That requires that we hold the RCU read side lock while doing the trace.
Not sure if that can be done inside the DECLARE_EVENT_CLASS() macro.
> + __field(unsigned int, context)
> + __field(unsigned int, seqno)
> + ),
> +
> + TP_fast_assign(
> + __assign_str(driver);
> + __assign_str(timeline);
> + __entry->context = fence->context;
> + __entry->seqno = fence->seqno;
> + ),
> +
> + TP_printk("driver=%s timeline=%s context=%u seqno=%u",
> + __get_str(driver), __get_str(timeline), __entry->context,
> + __entry->seqno)
> +);
> +
> /*
> * Safe only for call sites which are guaranteed to not race with fence
> * signaling,holding the fence->lock and having checked for not signaled, or the
> * signaling path itself.
> */
> -DECLARE_EVENT_CLASS(dma_fence,
> +DECLARE_EVENT_CLASS(dma_fence_ops,
>
> TP_PROTO(struct dma_fence *fence),
>
> @@ -67,7 +92,7 @@ DEFINE_EVENT(dma_fence, dma_fence_enable_signal,
> TP_ARGS(fence)
> );
>
> -DEFINE_EVENT(dma_fence, dma_fence_signaled,
> +DEFINE_EVENT(dma_fence_ops, dma_fence_signaled,
The signal trace event is actually unproblematic. The question is more what to do with the release event.
Regards,
Christian.
>
> TP_PROTO(struct dma_fence *fence),
>